Crash signature "WPEFramework::Core::JSON::String::Serialize" seen in multiple places

[npoltorapavlo]

Root cause - uninitialized char arrays. By assigning such to WPEFramework::Core::JSON::String there is a segfault with given signature. In several investigated cases char[] come from IARM_Bus_..._Param_t structures. IARM_Bus_Call may not initialize the array, and the calling code isn't checking for errors.

E.g

IARM_Bus_..._Param_t param;   <--- uninitialized
IARM_Result_t res = IARM_Bus_Call(..., (void *)&param,  <--- result not checked
LOGWARN("... %s\n", param.powerState   <--- use of uninitialized
response["state"] = string (param.powerState   <--- use of uninitialized

[npoltorapavlo]

One crash due to uninitialized variables (specifically, char arrays) was identified in DELIA-68891 - uninitialized structure in SystemServices::getPowerStateBeforeReboot. The bug was causing Undefined behavior and intermittent crash with signature WPEFramework::Core::JSON::String::Serialize - DELIA-66187.

It is not the only place in code where uninitialized variables are used.

StateObserver:

IARM_Bus_SYSMgr_GetSystemStates_Param_t param; <--- uninitialized
IARM_Bus_Call(IARM_BUS_SYSMGR_NAME, IARM_BUS_SYSMGR_API_GetSystemStates, &param, sizeof(param));
  ^ no error checks
JsonArray response_arr;
for( std::vector<string>::iterator it = pname.begin(); it!= pname.end(); ++it )
{
    string err_str="none";
    JsonObject devProp;
    if(*it == SYSTEM_CHANNEL_MAP)
    {
       int channelMapState = param.channel_map.state; <--- uninitialized is used
...
string dac_init_str(param.dac_init_timestamp.payload); <--- uninitialized char array is used
devProp["value"]=dac_init_str;

WPEFramework::Core::JSON::String::Serialize crash happens due to a bug in Thunder when it serializes unprintable characters, such characters originate from reading uninitialized variables.

In some places, unititialized boolean or number is used. This does not cause seg fault, but a random value is returned by API:

IARM_Bus_PWRMgr_NetworkStandbyMode_Param_t param; <--- uninitialized
IARM_Result_t res = IARM_Bus_Call(IARM_BUS_PWRMGR_NAME,
                       IARM_BUS_PWRMGR_API_GetNetworkStandbyMode, (void *)&param,
                       sizeof(param));
  ^ no error checks
bool nwStandby = param.bStandbyMode; <--- uninitialized variable is used

Also in some places the following pattern is seen:

myarray[sizeof(myarray) - 1] = '\0'; 

even though this sets some zero-termination, all bytes before that are still uninitialized and so can cause problems like mentioned crash in Thunder.

[npoltorapavlo]

Tickets:
DELIA-66187 - Thunder bug.
DELIA-68891 - uninitialized structure in SystemServices::getPowerStateBeforeReboot.
DELIA-69147 - other uninitialized variables.
DELIA-68897 - WPEFramework::Core::JSON::String::Serialize crash in HdmiCecSource/HdmiCecSink.